How To Protect Businesses from Social Engineering Attacks this Cybersecurity Awareness Month and Beyond 

Don’t be afraid of social engineering attacks this Cybersecurity Awareness Month! Use the four tactics in this article to defend against them. 

This year marks the 20th anniversary of Cybersecurity Awareness Month, a collaborative effort between government and businesses to raise awareness about digital security and empower both organizations and individuals to protect their online data from cybercriminals.  

NetSPI is proud to be recognized among industry peers as a Cybersecurity Awareness Month Champion Organization. As a leader in offensive security, we’re committed to partnering with our peers to collectively advance security. Technology has a significant impact on addressing cybersecurity challenges. However, people are an essential part of keeping personal and business data secure. By working together, we can make strides toward stronger systems and safer data as a whole. 

Security education and awareness have come a long way since the first Cybersecurity Awareness Month 20 years ago. But the mission never ends. More effort is needed to protect expanding attack surfaces against increasingly sophisticated threat actors. The theme for 2023’s Cybersecurity Awareness Month is “Secure Our World,” focusing on ways individuals and businesses can protect against online threats. 

In the spirit of this year’s theme, we created a parody of the Monster Mash to share social engineering prevention tips far and wide. Enjoy the video and share with your teams for a nudge toward improved security this October and year-round!

Read on to learn the importance of these social engineering prevention tips, and how you can keep your business and customer data more secure. 

Use Strong Passwords and a Password Manager 

In 2022, threat actors leaked more than 721 million passwords. Among the passwords exposed, 72 percent of users were found to be still using already-compromised passwords. 

As threat actors identify new ways to expose more passwords, using unique passwords is essential to protecting business and personal data.  

Some best practices for strong passwords include:

• Using unique passwords for each online account or platform 
• Updating passwords as soon as you’re notified of a breach  
• Creating long passwords (typically longer than 12 characters) 
• Ensuring passwords are complex by using a combination of lowercase and capital letters, numbers, and special characters  
• Avoiding personal identifiable information in passwords, such as birth dates, your address, pet names, family member names, or your company name 

To secure your passwords further, use a password manager, which helps users create, save, manage, and use passwords across different online services and accounts. Passwords are stored in an encrypted database to ensure protection and when a user is logged into the password manager, credentials can be retrieved so unique passwords don’t need to be remembered for each individual account. Using a password manager goes a long way toward removing the friction that can deter people from proper password hygiene.

Turn on Multifactor Authentication

Even strong, secure passwords can be exposed by attackers. Leveraging multifactor authentication (MFA) can prevent exposed passwords from being used. MFA is a multi-step process that requires users to enter more information than simply a password to log into an account.  

Some platforms or services require MFA while others include it as an option for user accounts. Taking a few extra seconds to complete MFA can significantly enhance security.

Some examples of multifactor authentication include:

• Security questions to verify a user’s identity 
• Codes sent to a user’s phone number or email address  
• Fingerprint verification on mobile devices  

NetSPI’s Social Engineering Lead, Patrick Sayler, underscored the importance of multifactor authentication in today’s threat environment: 

“Multifactor authentication is an absolute requirement if you’re exposing services to the internet. It may not prevent modern adversary-in-the-middle phishing campaigns, which can intercept both the time-based token value and resulting user session, but it still acts as an excellent first line of defense against password-spraying and basic phishing attacks. 

However, MFA fatigue is a legitimate concern and has resulted in initial access during our external network tests on numerous occasions. Most corporate multifactor solutions now offer number matching to prevent users from accidentally accepting a rogue authentication request. Enabling this feature requires a user to enter a specific number in their MFA mobile app, which prevents them from accidentally accepting a rogue incoming push notification.”

Recognize and Report Phishing

Social engineering, which refers to when threat actors attempt to trick employees into exposing sensitive information, is on the rise. In fact, 98 percent of cyber attacks involve some form of social engineering.  

Some of the most common types of social engineering include vishing (phone), phishing (email), and smishing (text).  

As an example, a vishing attack recently took down several of casino chain MGM Resorts’ systems, including hotel room keys and slot machines, for a few days. The threat actors responsible for the attack leveraged vishing through MGM’s help desk to gain access to the network. They found an employee’s information on LinkedIn, pretended to be them in a call to MGM’s IT help desk, and obtained credentials to access and infect the systems. 

This attack underscores the importance of recognizing and reporting vishing, phishing, and other similar social engineering attacks.  

Sayler shared, “For the help desk, having a set workflow of interactions, policies, and requirements, and sticking to them, will greatly reduce an attacker’s chance of success. Whenever I call and they start to push back, I end it and try to get a different agent on the phone. If they push back too, then that’s a good indicator that the department has been effectively trained and likely won’t deviate from the proper procedure. There’s only so much that you can do if everyone follows an established process and isn’t willing to budge.” 

Steps businesses can take to recognize, report, and prevent phishing and related social engineering attacks include:

• Train all employees on security best practices and processes from the top down – including C-suite employees – rather than only educating new team members on procedures 
• Create and implement a standardized playbook for employees to use when faced with a malicious form of communication 
• Leverage email security technologies but don’t rely on them as your only line of defense 
• Screen all incoming calls, text messages, and emails for malicious behavior 
• Test your framework by engaging penetration testing services to perform common social engineering attack methods within your organization 

Update Software

Many individuals make the mistake of falling behind on software updates for their personal or business systems. Some factors that contribute to this include that users are unaware that updates or patches are available, or they need a notification for an update while they’re in the middle of a task, resorting to pushing the update off to a later date.

According to NetSPI’s Offensive Security Vision Report, software versions with known vulnerabilities can be an easy target for malicious actors and have a significant impact on personal or business security. Our analysis of more than 300,000 anonymized findings from thousands of pentest engagements showed that Vulnerable Software and OS Versions (Missing Critical Patches) is a top vulnerability for both external networks and the cloud. 

New exploits are released on a regular basis by security researchers (as well as threat actors), and if left unpatched, outdated software can quickly become an entry point into the organization. 

Some tips to ensure you update software to the latest, most secure versions include:

• Enable automatic updates so you don’t need to monitor for the latest patches and enhancements on your own 
• Update software when prompted, even if this means pausing your work for a few minutes to restart your devices  
• Be aware of red flags for phishing, such as pop-up windows in your browser prompting you to urgently update software

Enhance Offensive Security with NetSPI

While Cybersecurity Awareness Month takes place once a year, an ongoing commitment to enhanced security will help us all move the needle. To strengthen your company’s social engineering prevention, NetSPI’s social engineering testing can help validate and improve your procedural security controls and employee training.  

Learn more about NetSPI’s social engineering services or schedule a demo to speak directly with a member of our team.